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Counselor 

U.S. Department of Commerce 
1401 Constitution Ave., NW 
Washington, DC 20230 

Mr. Ted Dean 
Deputy Assistant Secretary 
International Trade Administration 
1401 Constitution Ave., NW 
Washington, DC 20230 

Dear Mr. Antonipillai and Mr. Dean: 

This letter provides a brief overview of the primary investigative tools used to obtain 
commercial data and other record information from corporations in the United States for criminal 
law enforcement or public interest (civil and regulatory) purposes, including the access 
limitations set forth in those authorities. 1 These legal processes are nondiscriminatory in that 
they are used to obtain information from corporations in the United States, including trom 
companies that will self-certify through the US/EU Privacy Shield framework, without regard to 
the nationality of the data subject. Further, corporations that receive legal process in the United 
States may challenge it in court as discussed below. 2 

Of particular note with respect to the seizure of data by public authorities is the Fourth 
Amendment to the United States Constitution, which provides that “[t]he right of the people to 


1 This overview does not describe the national security investigative tools used by law enforcement in terrorist» and 
other national security investigations, including National Security Letters (NSLs) for certain record infonnation in 
credit reports, fmancial records, and electronic subscriber and transaction records, see 12 U.S.C. § 3414; 15 U.S.C. § 
1681u; 15 U.S.C. § 1681v; 18 U.S.C. § 2709, and for electronic surveillance, search warrants, business records, and 
other collection of Communications pursuant to the Foreign Intelligence Surveillance Act, see 50 U.S.C. § 1801 et 
seq. 

2 This paper discusses federal law enforcement and regulatory authorities; violations of state law are investigated by 
States and are tried in state courts. State law enforcement authorities use warrants and subpoenas issued under state 
law in essentially the same marmer as described herein, but with the possibility that state legal process may be 
subject to protections provided by State constitutions that exceed those of the U.S. Constitution. State law 
protections must be at least equal to those of the U.S. Constitution, including but not limited to the Fourth 
Amendment. 
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be secure in their persons, houses, papers, and effects, against unreasonable searches and 
seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported 
by Oath or affirmation, and particularly describing the place to be searched, and the persons or 
things to be seized.” U.S. Const. amend. IV. As the United States Supreme Court stated in 
Berger v. State of New York, “[tjhe basic purpose of this Amendment, as recognized in countless 
decisions of this Court, is to safeguard the privacy and security of individuals against arbitrary 
invasions by govemment officials.” 388 U.S. 41, 53 (1967) ( citing Camara v. Mun. Court of San 
Francisco, 387 U.S. 523, 528 (1967)). In domestic criminal investigations, the Fourth 
Amendment generally requires law enforcement officers to obtain a court-issued warrant before 
conducting a search. SeeKatzv. United States, 389 U.S. 347, 357 (1967). When the warrant 
requirement does not apply, govemment activity is subject to a “reasonableness” test under the 
Fourth Amendment. The Constitution itself, therefore, ensures that the U.S. govemment does 
not have limitless, or arbitrary, power to seize private information. 

Criminal Law Enforcement Authorities: 

Federal prosecutors, who are officials of the Department of Justice (DOJ), and federal 
investigative agents including agents of the Federal Bureau of Investigation (FBI), a law 
enforcement agency within DOJ, are able to compel production of documents and other record 
information ftom corporations in the United States for criminal investigative purposes through 
several types of compulsory legal processes, including grand jury subpoenas, administrative 
subpoenas, and search warrants, and may acquire other Communications pursuant to federal 
criminal wiretap and pen register authorities. 

Grand Jury or Trial Subpoenas : Criminal subpoenas are used to support targeted law 
enforcement investigations. A grand jury subpoena is an official request issued ftom a grand 
jury (usuatly at the request of a federal prosecutor) to support a grand jury investigation into a 
particular suspected violation of criminal law. Grand juries are an investigative arm of the court 
and are impaneled by a judge or magistrate. A subpoena may require someone to testify at a 
proceeding, or to produce or make available business records, electronically stored information, 
or other tangible items. The information must be relevant to the investigation and the subpoena 
cannot be unreasonable because it is overbroad, or because it is oppressive or burdensome. A 
recipiënt can file a motion to challenge a subpoena based on those grounds. See Fed. R. Crim. P. 
17. In limited circumstanees, trial subpoenas for documents may be used after the case has been 
indicted by the grand jury. 

Administrative Subpoena Authoritv : Administrative subpoena authorities may be 
exercised in criminal or civil investigations. In the criminal law enforcement context, several 
federal statutes authorize the use of administrative subpoenas to produce or make available 
business records, electronically stored information, or other tangible items in investigations 
involving health care fraud, child abuse, Secret Service protection, controlled substance cases, 
and Inspector General investigations implicating govemment agencies. If the govemment seeks 
to enforce an administrative subpoena in court, the recipiënt of the administrative subpoena, like 
the recipiënt of a grand jury subpoena, can argue that the subpoena is unreasonable because it is 
overbroad, or because it is oppressive or burdensome. 
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Court Orders For Pen Register and Trap and Tracés : Under criminal pen register and 
trap-and-trace provisions, law enforcement may obtain a court order to acquire real-time, non- 
content dialing, routing, addressing, and signaling information about a phone number or email 
upon certification that the information provided is relevant to a pending criminal investigation. 
See 18 U.S.C. §§ 3121-3127. The use or installation of such a device outside the law is a federal 
crime. 


Electronic Communications Privacy Act fECPA) : Additional mies govern the 
govemment’s access to subscriber information, traffic data, and stored content of 
Communications held by ISPs, telephone companies, and other third-party service providers, 
pursuant to Title II of ECPA, also called the Stored Communications Act (SCA), 18 U.S.C. §§ 
2701-2712. The SCA sets forth a system of statutory privacy rights that limit law enforcement 
access to data beyond what is required under constitutional law ffom customers and subscribers 
of Internet service providers. The SCA provides for increasing levels of privacy protections 
depending on the intmsiveness of the collection. For subscriber registration information, IP 
addresses and associated time stamps, and billing information, criminal law enforcement 
authorities must obtain a subpoena. For most other stored, non-content information, such 'as 
email headers without the subject line, law enforcement must present specific facts to a judge 
demonstrating that the requested information is relevant and matcrial to an ongoing criminal 
investigation. To obtain the stored content of electronic Communications, generally, criminal 
law enforcement authorities obtain a warrant ffom a judge based on probable cause to believe the 
account in question contains evidence of a crime. The SCA also provides for civil liability and 
criminal penalties. 

Court Orders for Surveillance Pursuant to Federal Wiretap Law : Additionally, law 
enforcement may intercept in real time wire, oral, or electronic Communications for criminal 
investigative puiposes pursuant to the federal wiretap law. See 18 U.S.C. §§ 2510-2522. This 
authority is available only pursuant to a court order in which a judge fïnds, inter alia, that there is 
probable cause to believe that the wiretap or electronic interception will produce evidence of a 
federal crime, or the whereabouts of a fugitive fleeing from prosecution. The statute provides for 
civil liability and criminal penalties for violations of the wiretapping provisions. 

Search Warrant - Rule 41 : Law enforcement can physically search premises in the 
United States when authorized to do so by a judge. Law enforcement must demonstrate to the 
judge based on a showing of “probable cause” that a crime was committed or is about to be 
committed and that items connected to the crime are likely to be found in the place specifïed by 
the warrant. This authority is often used when a physical search by police of a premise is needed 
due to the danger that evidence may be destroyed if a subpoena or other production order is 
served on the Corporation. See U.S. Const. amend. IV (discussed in further detail above); Fed. R. 
Grim. P. 41. The subject of a search warrant may move to quash the warrant as overbroad, 
vexatious, or otherwise improperly obtained, and aggrieved parties with standing may move to 
suppress any evidence obtained in an unlawful search. See Mapp v. Ohio, 367 U.S. 643 (1961). 

DOJ Guidelines and Policies: In addition to these Constitutional, statutory, and rule- 
based limitations on govemment access to data, the Attomey General has issued guidelines that 
place further limits on law enforcement access to data, and that also contain privacy and civil 
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liberty protections. For instance, the Attomey GeneraFs Guidelines for Domestic Federal 
Bureau of Investigation (FBI) Operations (September 2008) (hereinafter AG FBI Guidelines), 
available at http://www.justice.gov/archive/opaydocs/guidelines.pdf, set limits on use of 
investigative means to seek information related to investigations that involve federal crimes. 
These guidelines require that the FBI use the least intrusive investigative methods feasible, 
taking into account the effect on privacy and civil libeities and the potential damage to 
reputation. Further, they note that “it is axiomatic that the FBI must conduct its investigations 
and other activities in a lawful and reasonable manner that respects liberty and privacy and 
avoids unnecessary intrusions into the lives of law-abiding people.” See AG FBI Guidelines at 
5. The FBI has implemented these guidelines through the FBI Domestic Investigations and 
Operations Guide (DIOG), available at https://vault.fbi.gov/FBI%20Domestic%20Investigations 
%20and%200perations%20Guide%20(DIOG), a comprehensive manual that includes detailed 
limits on use of investigative tools and guidance to assure that civil liberties and privacy are 
protected in every investigation. Additional rules and policies that prescribe limitations on the 
investigative activities of federal prosecutors are set out in the United States Attomeys ’ Manual 
(USAM), also available online at http://www.justice.gov/usam/united-states-attomeys-manual. 

Civil and Regulatory Authorities (Public Interest): 

There are also significant limits on civil or regulatory (i.e., “public interest”) access to 
data held by corporations in the United States. Agencies with civil and regulatory 
responsibilities may issue subpoenas to corporations for business records, electronically stored 
information, or other tangible items. These agencies are limited in their exercise of 
administrative or civil subpoena authority not only by their organic statutes, but also by 
independentjudicialreview of subpoenas prior to potential judicial enforcement. See, e.g., Fed. 
R. Civ. P. 45. Agencies may seek access only to data that is relevant to marters within their 
scope of authority to regulate. Further, a recipiënt of an administrative subpoena may challenge 
the enforcement of that subpoena in court by presenting evidence that the agency has not acted in 
accordance with basic standards of reasonableness, as discussed earlier. 

There are other legal bases for companies to challenge data requests from administrative 
agencies based on their specific industries and the types of data they possess. For example, 
financial institutions can challenge administrative subpoenas seeking certain types of information 
as violations of the Bank Secrecy Act and its implementing regulations. See 31 U.S.C. § 5318; 

31 C.F.R. Part X. Other businesses can rely on the Fair Credit Reporting Act, see 15 U.S.C. § 
1681b, or a host of other sector specific laws. Misuse of an agency’s subpoena authority can 
result in agency liability, or personal liability for agency officers. See, e.g., Right to Financial 
Privacy Act, 12 U.S.C. §§ 3401-3422. Courts in the United States thus stand as the guardians 
against improper regulatory requests and provide independent oversight of federal agency 
actions. 

Finally, any statutory power that administrative authorities have to physically seize 
records from a company in the United States pursuant to an administrative search must meet the 
requirements of the Fourth Amendment. See See v. City ofSeattle , 387 U.S. 541 (1967). 
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Conclusion: 

All law enforcement and regulatory activities in the United States must conform to 
applicable law, including the U.S. Constitution, statutes, rules, and regulations. Such activities 
must also comply with applicable policies, including any Attomey General Guidelines goveming 
federal law enforcement activities. The legal framework described above limits the ability of 
U.S. law enforcement and regulatory agencies to acquire information from corporations in the 
United States — whether the information concerns U.S. persons or citizens of foreign countries — 
and in addition permits judicial review of any govemment requests for data pursuant to these 
authorities. 


Sincerely, 



/ 


Brace C. Swartz 

eputy Assistant Attomey General and 
Counselor for IntematWal Affairs 







